CVE-2026-44492: Axios NO_PROXY IPv4-Mapped IPv6 Bypass Vulnerability (CVSS 8.6)

Technical summary

Axios versions prior to 0.32.0 (for the 0.x branch) and 1.16.0 (for the 1.x branch) fail to normalize IPv4-mapped IPv6 addresses when evaluating the NO_PROXY environment variable and configuration. IPv4-mapped IPv6 addresses follow the format ::ffff:x.x.x.x (or in hexadecimal, ::ffff:xxxx:xxxx). The library compares the request URL's host against the no-proxy list without converting IPv4-mapped IPv6 addresses to their canonical IPv4 form, so entries like 127.0.0.1 do not match requests to ::ffff:7f00:0:1. Because Node.js transparently resolves IPv4-mapped IPv6 addresses to their IPv4 equivalents at the socket level, the proxy connection is still attempted, and the underlying IPv4 service receives the request via that proxy path. This violates the intended isolation of internal services from external proxy infrastructure.

Business impact

Organizations relying on Axios with proxy bypass configurations to isolate internal services may face unintended exposure of those services. Internal endpoints—such as metadata services (169.254.169.254), local application servers, or administrative interfaces—that should bypass the proxy can be inadvertently routed through external or untrusted proxy infrastructure. This could allow attackers within the network perimeter to exfiltrate data, inject payloads, or perform reconnaissance on services that were meant to be isolated. The impact is particularly severe for containerized and cloud environments where metadata services are common attack targets.

Affected systems

Applications using Axios versions 0.x prior to 0.32.0 and 1.x prior to 1.16.0 are affected. This includes any Node.js application or frontend project bundling Axios that relies on NO_PROXY configuration to restrict proxy usage for internal IPs. The vulnerability is relevant across web servers, microservices, Lambda functions, and containerized deployments that use Axios for HTTP requests.

Exploitability

Exploitation is straightforward and requires no special privileges. An attacker with network access to an Axios application can craft a URL using an IPv4-mapped IPv6 address (e.g., replacing 127.0.0.1 with ::ffff:7f00:0:1) to bypass the no-proxy list. No authentication, user interaction, or complex exploit chains are needed. The CVSS 3.1 score of 8.6 (HIGH) reflects the ease of exploitation (network-accessible, no prerequisites) and the potential for high confidentiality impact. However, it is not in CISA's Known Exploited Vulnerabilities catalog at this time, indicating limited evidence of active, weaponized exploitation in the wild.

Remediation

Upgrade Axios to version 0.32.0 or later (for 0.x users) or version 1.16.0 or later (for 1.x users). Both releases include normalization logic to canonicalize IPv4-mapped IPv6 addresses before comparing against the NO_PROXY list. After patching, verify that your application's package-lock.json or yarn.lock reflects the updated version, and conduct smoke testing of proxy bypass behavior in your environment.

Patch guidance

Identify all applications and dependencies that vendor Axios. Use npm audit, yarn audit, or SCA tooling to detect affected versions. Schedule patching in line with your change management process. For 0.x-branch users, upgrade to 0.32.0+. For 1.x-branch users, upgrade to 1.16.0+. Test in a staging environment first, particularly if your application relies on proxy-bypass logic for internal service communication. Automated CI/CD dependency scanning can help prevent future inclusion of vulnerable versions.

Detection guidance

Review application manifests (package.json) for Axios versions < 0.32.0 or < 1.16.0. Monitor for HTTP requests to IPv4-mapped IPv6 addresses (::ffff: prefix) originating from your applications, which could indicate attempted exploitation. Check proxy logs for connections to internal IP ranges that should have been bypassed, and correlate with application logs to identify which Axios-based service is the source. SIEM rules matching IPv4-mapped IPv6 addresses in HTTP clients may surface suspicious activity.

Why prioritize this

This vulnerability merits prompt attention despite its non-KEV status due to its high CVSS score (8.6), ease of exploitation, and direct impact on isolation of internal services in modern cloud and containerized environments. The bypass of NO_PROXY configuration undermines a fundamental security control. Patching is straightforward and carries low risk. Organizations should prioritize this in their patch cycle, especially those using Axios in container orchestration, serverless, or microservices architectures where metadata and admin services are prevalent.

Risk score, explained

The CVSS 3.1 score of 8.6 (HIGH, vector AV:N/AC:L/PR:N/UI:N/S:C) reflects: network-accessible attack vector, low attack complexity, no privileges or user interaction required, and changed scope (proxy infrastructure involvement affects broader system context). Confidentiality impact is high—internal services can be exposed. Integrity and availability impacts are scored as none in the base vector, though downstream exploitation of exposed services could elevate those. The score does not account for organizational reliance on proxy-bypass controls or cloud-native threat models where this bypass is particularly damaging.

Frequently asked questions